Start specific app from sandbox unsandboxed

[exander77]

I have a program that runs other programs and I want some of these programs to be run without Sandbox, is that possible?

It reminds me "Start Restrictions", but I don't seem to find a way how to start a program outside Sandbox there.

[exander77]

Related also to: #1070 #1412

[exander77]

I have made a 50€ contribution so this request is taken more seriously. :)

[DavidXanatos]

Thank you very much,
so I'll have to seriously thing about how to achieve that.

[exander77]

Thank you very much, so I'll have to seriously thing about how to achieve that.

Not a problem! I noticed that SandboxIE is now OpenSource and have an active developer, so thank you very much for your good work.

A very common use case for SandboxIE is to run Steam multiple times. We use Aster V7 (or other software) to multiseat which gives you basically two (or multiple) stations from one computer. But Steam is a real pain, it just doesn't want to launch more than one instance even under different Windows users. It will kill the other instance. I have used SandboxIE for this purpose for years. But it presents other issues. The games themselves have no issues (like 99%) running multiple times, on the other hand sandboxing is sometimes messing with various things like anticheat software etc. I imagine a solution that you run just Steam inside the Sandbox, but launch the actual games outside and let them do what they want to do, even though I don't like anticheat software messing with my system as well and I would rather use it in Sandbox completely, but it is easier and without risk of unwarranted ban.

So this is not usually so much security-focused as much of a convenience focused solution. The problem I see is that there is some interprocess communication between Steam and the game.

I just tried lowering the Sandbox capabilities to the bare minimum in the supported version, but still have issues with EAC similar to this: https://issueexplorer.com/issue/sandboxie-plus/Sandboxie/1192

I really like mutliseating and supporting people using it, because it is green. fewer computers made, less electricity consumed, etc. And easier to maintain (even with occasional troubles like these).

[DavidXanatos]

How should we call this setting?
BreakoutProcess=some.exe
???

[exander77]

@DavidXanatos Sounds good.

[DavidXanatos]

So the feature will be included in the 1.0.8 build,
with it programs that are not installed to a sandbox can be made to break out,
note however that if an other sandbox is configured to force this process name it will do so.

So example some application opens a web browser and its box is configured to allow firefox.exe to break out,
but an other box is configured to force firefox.exe here the process will break out of one box only to end up in an other, muhahahahah....

I think this behavior allows to use this feature also for security applications, not only for software compartmentalization.

There are minor limitations such as that the process created outside will have certain privileges removed and if DropAdminRights=y is in place also user groups dropped, as it inherits the original token from the sandboxed parent.
In most cases this should not pose any issues, most programs don't need those anyways.

The filtering of the original token for the sandboxed processes can be disabled with the debug option UnfilteredToken=y but this weakens the isolation of boxes configured this way so its not recommended.

[exander77]

@DavidXanatos Behaviour with forced processes makes sense.

I will test it as soon as the 1.0.8 is available.

[exander77]

Btw, will it be possible to set the breakout process as a path?
Like: BreakoutProcess=E:\Path\*
Or something of that kind, to launch everything from that location unsandboxed?
That would even nicely play with the forced process. You could set a path that will be sandbox, but still, put some of the processes into sandbox.

[DavidXanatos]

No paths were not intended in this feature, should I add those?
This feature seams to be more and more complicated, I should have set up some donatin bounty...

[exander77]

It is not really needed for my purposes, but I was thinking about the forced processes you mentioned and how you set up OpenXXXPath=* etc. and it might be interesting to some users to set whole folders. This would be basically OpenBreakoutPath, ProcessBreakoutPath or something.

[DavidXanatos]

It will be BreakoutFolder= to stay consistent with the forced and alert folder stuff

[exander77]

It will be BreakoutFolder= to stay consistent with the forced and alert folder stuff

That makes sense, it is closer to that functionality.

[exander77]

Works like a charm. You should advertise this feature for those who use it with Steam.

[Etolog]

Works like a charm. You should advertise this feature for those who use it with Steam.

how you make it works? cans you send your ini? :)
i make eac go out sandbox no error but it looks like he cant find steam because it in sandbox and just give me login screen ;/

[Naeemh1]

This feature is rather significant, would you mind making it open to all users prior to the 250 patrons?

[exander77]

Works like a charm. You should advertise this feature for those who use it with Steam.

how you make it works? cans you send your ini? :) i make eac go out sandbox no error but it looks like he cant find steam because it in sandbox and just give me login screen ;/

Easiest was is to use:

BreakoutFolder=

And set it to your steamapps folder. So Steam will be started in Sandbox, but any program from steamapps will be started outside. You can limit it to just a specific game folder or just a specific process using BreakoutProcess.

[exander77]

This feature is rather significant, would you mind making it open to all users prior to the 250 patrons?

I recommend people to support SandboxIE, it is a great product.

[Naeemh1]

I am using Sandboxie and yes it's great. But this feature (Breakout) requires the user to be a supporter.
To be honest I need this feature since ms office products aren't working sandboxed.

[isaak654]

You can still receive a certificate for free by contributing to the project in a meaningful way: #1388 (comment)

For example: #1388 (comment)

If you did that already, drop an email to @DavidXanatos, then you'll get one.

[Naeemh1]

Oh thank you, that's good to know. I'll definitely check out some way to contribute to the project non-monetarily.